Mastercard
14
min read
Mastercard is a payment network that has spent the last decade quietly turning into something else. In FY2014, value-added services accounted for roughly 12% of revenue. In FY2025, the same line was 40.6%, against about 30% at Visa over a comparable stretch. The shift was not the result of one or two large acquisitions absorbed and rebranded under Mastercard. It came from a portfolio of standalone brands — Recorded Future, Finicity, Ekata, RiskRecon, Aiia, Brighterion, Ethoca, Dynamic Yield, Minna, and now BVNK — each bought, each largely retained as a separate brand, each selectively fused back into the network through productized layers like Decision Intelligence Pro and Mastercard Threat Intelligence.
This is the pattern worth naming. When a company cannot outscale the network it operates — and Mastercard, at roughly 60–65% of Visa's payments volume, cannot — productizing what is adjacent to that network is one of the few real strategic moves left. The trick is not to absorb the adjacencies but to federate them. Standalone brands preserve buyer sets the core network cannot reach: governments, enterprises, SMBs, AI agents that may never touch a Mastercard card. Selective fusion preserves the moat.
CFO Sachin Mehra's 2024 Investor Day disclosure made the operating ratio explicit — about 60% of value-added services revenue is "network-linked" and scales with switched transactions; the remaining ~40% is fully adjacent. That ratio is the doctrine. Pure adjacency would dilute the moat. Pure fusion would shrink the buyer set to issuers and acquirers. The federation handles both — but only if the data substrate underneath measurably improves the acquired adjacency post-close. Without that, the same playbook is a private-equity roll-up.
The strategy in one picture
Three things should be visible at a glance. First, the network itself sits at the bottom — about $9.2T GDV and 175 billion switched transactions in FY2025, smaller than Visa, and not getting past Visa on rails alone. Second, the productization layer above is wide. The brands are heterogeneous, mostly retained from acquisition, and sold to a buyer set that extends well beyond the financial-institution audience that buys network services. Third, that layer splits cleanly: network-linked products feed back into the substrate and are improved by it; pure adjacencies run as standalone businesses with their own clients, mostly governments and enterprises. The company itself draws the line at roughly 60/40.
This is a different shape from Visa, which fuses more deeply into a smaller services aperture. The Visa piece in this series called that "substrate-fusion as moat." Mastercard's answer is the federation around the moat.
How it actually works — three closed loops
Loop 1 — Network signal feeds the federated brands; the federated brands sell that signal as a product
The cleanest example is Mastercard Threat Intelligence, launched at Money20/20 USA on October 28, 2025 — ten months after the Recorded Future acquisition closed. Recorded Future indexes the open, dark, and technical web; Mastercard's network sees ~175 billion switched transactions a year. The product fuses both — five modules covering card testing, digital skimming, merchant threat, payment-ecosystem threat, and payment intelligence reports. In six months of pre-launch testing the system identified malicious domains affecting nearly 9,500 e-commerce sites linked to roughly $120 million in fraud. The product is sold to issuers and acquirers globally; it would not exist without the Recorded Future buy and would not work without the network underneath.
This is what "network-linked" means at the operating level. Decision Intelligence Pro (launched February 2024, generative AI, scoring under 50ms) is the same loop in fraud — Brighterion's models trained on Mastercard transaction data, sold back to issuers as a fraud-decisioning service.
Loop 2 — Adjacent identity + open banking → tokens → agentic commerce → a new transaction class
Mastercard Agent Pay launched April 29, 2025 — a day before Visa Intelligent Commerce. The technical core is Mastercard Agentic Tokens, an extension of the tokenization framework that already powers contactless and card-on-file. Ekata (acquired 2021, identity), Finicity and Aiia (open banking), and the existing tokenization stack feed in; the output is a payment instrument an AI agent can present on behalf of a consumer. The partnership cascade through 2025–2026 — OpenAI Instant Checkout, Google's Universal Commerce Protocol, PayPal's wallet, Stripe, Ant International, Cloudflare — means Agent Pay rides on multiple agentic protocols rather than one. Citi and US Bank cardholders were enabled by mid-November 2025; all U.S. Mastercards followed shortly after.
The interesting thing about this loop is that it creates a new revenue line that did not exist eighteen months ago. Token-as-a-service for AI agents is a different product than traditional card interchange. It is also less correlated with debit-routing regulation, which matters in 2026.
Loop 3 — Standalone enterprise/government cyber → recurring revenue uncorrelated with card volume
Recorded Future is the model. Christopher Ahlberg is still its CEO; it operates as a separate entity with its own brand; its 1,900+ clients across 80 countries include 45 governments and over half of the Fortune 100. Industry estimates put its ARR around $300–400 million. Mehra disclosed in Q3 2025 that Recorded Future plus Minna together added about three percentage points to the quarter's services growth, implying Recorded Future was contributing roughly $80–100 million quarterly to value-added services by mid-2025.
The critical point — Recorded Future's revenue is largely not a function of Mastercard transaction volume. It is SaaS sold to security teams. RiskRecon (third-party cyber risk) and CipherTrace (crypto compliance) sit on the same side of the federation. The Cloudflare partnership announced February 17, 2026 extends this revenue line into critical infrastructure and small-business cyber defense. None of it requires the card to swipe.
The three loops together do something specific. Loop 1 deepens the moat. Loop 2 opens a new transaction class. Loop 3 diversifies the revenue base away from the rail. That is the structural answer to being the smaller-substrate network.
The numbers
Mastercard reported FY2025 net revenue of $32.79 billion, up 16% reported. Value-added services and solutions revenue grew 23% reported, 21% currency-neutral, ~18% organic — about 40.6% of total revenue, against ~30% at Visa over a comparable fiscal stretch. About three percentage points of FY2025's 21% currency-neutral services growth came from acquisitions, chiefly Recorded Future and Minna. Strip those out and the organic line is ~18%, still very strong. The cleaner signal arrived in Q1 2026, reported April 30, 2026: services up 18% currency-neutral with zero acquisition contribution — Recorded Future fully lapped December 12, 2025, Minna lapped earlier. Adjusted operating margin reached 60.8%. The federation is working organically, not just optically through M&A inflows.
The decade trajectory is the actual story.
Services moved from roughly 12% of revenue in FY2014 (per Raj Seshadri's public framing) to ~22% in FY2018, ~30% by FY2020, 38% in FY2024, 40.6% in FY2025. If the current organic spread holds — services around 18% versus payment network around 8% — services crosses 50% of revenue by 2028 or 2029.
The cumulative services M&A spend is approximately $10–11 billion across nine years. The largest checks are Nets A2A ($3.19B, 2019), Recorded Future ($2.65B, closed December 2024), and the pending BVNK deal ($1.5B + $300M earn-out, announced March 17, 2026). Across the same window Mastercard returned $17.6 billion to shareholders in FY2025 alone — buybacks run at roughly four to five times services M&A, which signals discipline rather than acquisition addiction. The honest forward question is whether the next big acquisition refreshes the inorganic line on the same cadence. So far, every three to five years, a major buy has arrived to do exactly that.
The named program owners matter for evaluating whether services has organizational permanence. Michael Miebach is CEO, in role since January 2021. Craig Vosburg has been Chief Services Officer since May 2024 — a single accountable executive who owns Cyber & Intelligence, Data & Services, Open Banking, and the Data & AI organization. Johan Gerber, EVP Global Head of Security Solutions, runs the cyber stack and reports to Vosburg; Christopher Ahlberg still runs Recorded Future and reports to Gerber. Jess Turner is EVP Global Head of Open Finance and Developer Experience, owning Finicity + Aiia. Sherri Haymond runs Digital Commercialization and is the public face of agentic commerce. Jorn Lambert is Chief Product Officer (the role Vosburg vacated to take Services). Sachin Mehra is CFO.
The pattern that the program-owner list reveals is the consolidation of services accountability into one C-suite role in 2024 — roughly six months before the Recorded Future close. The org chart was redesigned to receive the deal.
Is AI a norm inside Mastercard?
The test of normalization is whether the strategy survives executive succession. Three pieces of evidence argue that it does.
The first is structural. The Chief Services Officer role exists, has a single occupant (Vosburg, since May 2024), and aggregates accountability for cyber, identity, open banking, AI products, and data. Services is not floating across business units. If Miebach left tomorrow, his successor would inherit an org chart that already presupposes services as a first-class pillar.
The second is depth in the substrate. Brighterion AI scores 150 billion-plus transactions a year at sub-100ms latency. Decision Intelligence Pro is the network's default fraud-decisioning layer, deployed across all 175 billion 2025 switched transactions. This is not pilot work. It is the production substrate. AI is in the rail, not adjacent to it.
The third is the breadth of products.
Mastercard ships AI products into multiple buyer segments simultaneously: Decision Intelligence Pro to issuers, Mastercard Threat Intelligence to issuers and governments, Smart Subscriptions to banks, ScamProtect across consumer markets, Agent Pay to AI platforms, Agent Suite to enterprise consultants, Virtual C-Suite to SMBs, Mastercard Developers Agent Toolkit to builders. A single PoC in a single business unit is brittle to leadership change. Eight productized AI lines across four buyer segments is not.
The honest qualifier is that the agentic commerce line is younger than 18 months. Agent Pay launched April 2025; Agent Suite, Virtual C-Suite, and the Developer Toolkit are all 2026 launches. Whether the agentic stack survives a 2027 leadership change as a normalized product line is genuinely an open question — it has not yet weathered a downturn or a leadership shift. The fraud and cyber stack has, comfortably.
A stronger normalization test is whether the federation pattern itself outlasts the people who built it. Vosburg is the architect of "all services under one roof"; Miebach has been the consistent voice on the virtuous cycle of payments and data. The pattern's first non-trivial stress test is the 2026 strategic review, which produced a Q1 2026 restructuring charge of ~$200 million and affected roughly 4% of full-time employees globally. The interesting question is which products the review preserved and which it pruned. The signal so far — Agent Suite, Virtual C-Suite, and the BVNK announcement all rolled out during the review — is that the federation expanded, it did not contract. That is a stronger normalization signal than headcount cuts could undermine.
Why this answer fits Mastercard
Three things had to be true at the same time for federated productization to work, and they are.
The first is DNA. Mastercard has been the #2 network since the IPO in 2006, and #2 networks compete on something other than rail dominance. Robert Selander's tenure (1997–2010) emphasized make-versus-buy discipline; Ajay Banga (2010–2020) made services a strategic pillar; Miebach (2021–) made services a named strategic pillar in the formal three-priorities framework. The trajectory has had the same orientation across three CEOs and twenty-five years. That is unusually persistent doctrine for a U.S. public company.
The second is balance-sheet shape. Mastercard is asset-light, ~60% operating margin, around $7 billion in cash, no founding family, and the Mastercard Foundation's stake is now 7.4% (down from 13.5% at IPO and falling further as the Foundation diversifies via MFAM). M&A capacity is governed only by capital allocation discipline. Across 2017–2026, services M&A consumed roughly 5–10% of free cash flow — buybacks at 4–5× M&A spend keep the framing as buybacks-with-occasional-acquisitions, not the reverse.
The third is the inflection. Services hit ~12% of revenue around 2014 and started compounding faster than the network from there. The 2024 Investor Day disclosure of the 60% network-linked ratio crystallized the doctrine for investors; the 2024–2026 sequence — Recorded Future, Mastercard Threat Intelligence, Agent Pay, Agent Suite, Virtual C-Suite, Cloudflare, BVNK — operationalized it.
The Visa comparison is instructive on why this specific shape fits Mastercard.
Visa fuses to the rail; Mastercard federates around it. Visa's services M&A 2020–2025 is concentrated in payment-rail and processor adjacencies — Tink in Europe, Pismo for issuer processing, Featurespace for fraud — narrower aperture, deeper fusion, ~$4B disclosed. Mastercard's services M&A across the same window spans cyber, identity, crypto, open banking, subscriptions, threat intelligence, and now stablecoins — wider aperture, ~$6–7B disclosed, plus the pending $1.5B BVNK deal. On agentic commerce both networks moved within a day of each other in April 2025, but the postures differ: Visa anchors on a protocol (Trusted Agent Protocol, IETF/OpenID/EMVCo standards-track); Mastercard anchors on a product portfolio (Agent Pay + Agent Suite + Virtual C-Suite + multi-protocol participation across OpenAI, Google UCP, Cloudflare, PayPal). Visa's strength is mix-shift on a larger substrate; Mastercard's strength is a faster mix-shift compensating for a smaller one.
Why this does not transfer is the more useful question. Architecture vs. activation energy. Most large companies could in principle buy adjacent businesses; few have a data substrate that measurably improves them post-close. The Mastercard playbook only works because Decision Intelligence Pro is genuinely better than what Recorded Future could build alone, and because Mastercard tokenization is a real asset for Agent Pay that an AI lab cannot easily replicate. The architecture is the federation. The activation energy is the substrate. A company without the substrate that copies the federation pattern is running a roll-up.
Where it goes next
Three things to watch over the next eighteen months.
BVNK closes late 2026, and that closes the gap between "adjacent productization" and "multi-rail orchestration." BVNK is stablecoin infrastructure — the first major Mastercard buy that builds a rail competitive with its own card rail. The doctrine evolves from "federate around the network" to "federate across multiple networks, including non-card rails." If Mastercard handles BVNK the way it handled Recorded Future — standalone brand, fused product layer on top, broader buyer set — the doctrine extends naturally. If it tries to absorb BVNK into the card stack, the federation pattern breaks.
Agentic commerce gets monetized. Agent Pay shipped in 2025; Agent Suite and Virtual C-Suite shipped in early 2026; the open question is whether token-as-a-service for AI agents shows up as a disclosed revenue line by the FY2026 10-K. The agentic transaction class is real, the early partnerships are real, but the revenue is not yet broken out. The FY2026 disclosure will tell the market whether the agentic stack is a meaningful product or a positioning move.
Services crosses 50% of revenue around 2028–2029 if the current organic spread holds. That is when Mastercard formally stops being a network with ancillary services and becomes something genuinely hybrid — a payment network plus a services portfolio, where neither piece alone tells the right story. The 60/40 network-linked ratio probably drifts toward 55/45 as BVNK and the agentic stack mature, which is in line with the doctrine.
The risk on the other side is that the services-mix story is now substantially priced into the equity. A miss on organic services growth — say, sub-15% in two consecutive quarters — would force the market to revisit the multiple. Mastercard has not had that miss yet. If it does, the federation pattern survives but the framing around it shifts.
The diagnostic frame
Federated productization is a doctrine more than a playbook, and the diagnostic that separates companies running it deliberately from companies running a roll-up has four parts.
The first is post-close substrate uplift. Companies for which this pattern works can point to a productized layer that emerged from acquired adjacencies within roughly twelve months of close — and that layer would not exist on either side alone. Mastercard's test passes: Recorded Future got Mastercard Threat Intelligence ten months after close, fusing the threat-intelligence index with the network's transaction signal. Companies that buy adjacencies and ship nothing measurably better in the first year are running portfolio acquisition, not productization.
The second is a disclosed network-linked ratio. Companies that have a clear answer to the question "what fraction of services revenue is genuinely linked to the core operating data, and what fraction is fully adjacent?" — and can state it as a single number to investors — tend to be running the doctrine deliberately. Mehra's 60/40 disclosure is the cleanest example in payments. Most companies cannot answer this question because the line between "linked" and "adjacent" has not been drawn internally. Drawing the line is itself a strategic act; it forces a choice about which acquisitions to fuse and which to leave alone.
The third is single-point services accountability. Companies for which the pattern compounds tend to consolidate services into one C-suite role rather than letting it float across business units. Mastercard appointed Vosburg as Chief Services Officer in May 2024, ahead of Recorded Future close — the org redesign preceded the deal. Services that report to multiple GMs across regions or verticals rarely build the kind of cross-product layer (a Threat Intelligence, a Decision Intelligence Pro) that defines federated productization.
The fourth is the inflection in current numbers. Companies running this doctrine tend to have already passed the point where services revenue compounds faster than core revenue, and the gap widens year over year. Mastercard hit that inflection around 2014 and has compounded for a decade. Companies that talk about services as a future strategic pillar — without the inflection visible in current numbers — are usually 5–7 years behind where they think they are.
Taken together, the four diagnostics describe a company that has built the federation deliberately. Companies that fail two or more of them, and still try to copy the playbook, end up holding a portfolio of unrelated brands without a substrate underneath — which is the failure mode the doctrine is designed to avoid.
References